On 28 March, Indonesia began phased implementation of Ministerial Regulation No. 9/2026, issued earlier that month under Peraturan Pemerintah (PP) Tata Kelola Perlindungan Anak di Ruang Digital (TUNAS), the government regulation on protecting children in the digital space. The rules restrict children under 16 from holding accounts on platforms classified as high-risk, beginning with the largest social media, live-streaming and gaming services.
The concern behind these rules is real: Indonesian children face sexual exploitation, cyberbullying and harmful content, alongside AI-enabled risks such as synthetic abuse material, deepfake harassment and unsafe AI companions. Many of these harms are generated or amplified by recommendation algorithms and other platform systems. A national account restriction can limit children’s access, but changing those systems requires leverage over companies that operate across the region.
Indonesia is the first Association of Southeast Asian Nations (ASEAN) member to implement a nationwide age-based restriction. Its experience shows both the potential and limits of national action.
ASEAN cannot simply regulate across the region. It has no legal authority over online content or power to impose binding obligations on firms. Moreover, regional members’ capacity to enforce platform rules varies widely. ASEAN’s strength lies in scale, since Southeast Asia accounts for about one in ten of the world’s social media users. Compatible expectations across the region’s markets would give governments more leverage over the major platforms than any single national rule, and would enable members with fewer regulatory resources to adopt agreed regional standards.
The recent AI Asia Pacific Institute–Access Partnership paper Screens, Systems, and Safeguards: Online Harms, Artificial Intelligence, and the Governance of Children’s Digital Lives in ASEAN argues for shared evaluation and common minimum standards, while leaving access restrictions to member states.
By early August 2026, four months into implementation, Indonesia’s Ministry of Communication and Digital Affairs reported that platforms had deactivated around five million under-age accounts. The great majority were on TikTok: of the 4.7 million deactivations reported in late June, TikTok accounted for about 4.1 million and YouTube for about 600,000.
Some 200 platforms had also submitted risk self-assessments. These figures show that regulation can compel platforms to act. They do not yet show whether harms have shifted to less moderated services or whether age assurance is working accurately and fairly. Deactivations are a measure of platform compliance, not necessarily a signal of improved children’s safety.
Indonesia’s Communication and Digital Affairs Minister Meutya Hafid has said that not all platforms have shown evidence of adopting the best age-verification technology. The government has issued compliance and risk-assessment updates, but a comprehensive evaluation of the policy’s effects on harm, privacy, access and wrongful exclusion has not been published.
Australia, which began its restrictions in December 2025, around three and a half months before Indonesia, offers an early lesson: platform implementation matters more than the restriction itself. The eSafety Commissioner‘s three-month follow-up report found that account ownership among 10- to 15-year-olds had fallen from 52.4% to 42.1%. Yet among children who kept accounts, half had never been asked by platforms to confirm their age. This suggests the immediate gap lies in how consistently platforms apply age checks. The Australian case suggests that effective implementation depends on platform systems operating across markets, outside the full control of any government.
Malaysia, whose own under-16 rule took effect in June 2026, prescribes the method of age verification that Indonesia leaves to the platforms. The largest platforms operating in Malaysia must check age against official documents such as MyKad (the national smart identity card) or a passport. The document route promises more accurate checks than Australia’s age estimation, but has been delayed. The companies concerned, citing the risks of holding identity data, have pressed for Australia’s approach of platform-run age estimation, and Malaysia’s communications ministry has given them until January 2027 to comply. Indonesia and Malaysia are therefore negotiating separately with the same handful of companies over how age should be checked.
Different age thresholds, risk definitions and reporting requirements make it difficult for regulators to compare the same platform’s performance across markets. Shared definitions and reporting expectations would make those differences visible and strengthen governments’ ability to challenge poor performance. Regional coordination would not prevent children misstating their age or moving between services, but it could provide comparable evidence and shared safeguards. These should establish minimum protections while allowing countries to retain stronger requirements.
Such coordination would not need to start from scratch, as both Indonesia and the rest of ASEAN already have foundations to build on. Indonesia is not relying on an access restriction alone. PP TUNAS also imposes safety-by-design duties, age verification, risk-based limits on features and protection of children’s data. A separate National Roadmap for Child Protection in Online Contexts, enacted in 2025, covers coordination, reporting and evidence.
ASEAN’s child-protection instruments and its digital cooperation framework have developed separately, although neither sets out explicit shared expectations for how platforms should protect children. The 2019 Declaration on the Protection of Children from All Forms of Online Exploitation and Abuse and its Regional Plan of Action address exploitation and abuse. Digital officials meet each year at an ASEAN Information and Communications Technology Forum on Child Online Protection. The digital ministers’ main instrument, the ASEAN Digital Masterplan 2030, is a cooperative instrument, making it suitable for establishing common reference points rather than imposing uniform rules.
Three areas of coordination would make these existing frameworks more useful in practice. The objective should be compatibility, not identical regulation.
First, ASEAN could develop shared, non-binding expectations for platform safety, encouraging platforms to assess and mitigate risks to children from harmful content, recommendation algorithms and AI-enabled harms, and to provide evidence that those measures are effective. This would shift the focus to examining what platforms are doing to make their systems safer for children using them.
Second, ASEAN could establish common principles for age assurance based on proportionality, privacy and accessibility, while leaving implementation to individual member states. Regulators could then compare Malaysia’s mandated document checks and Indonesia’s platform-led methods against the same measures of accuracy, privacy and accessibility.
Third, ASEAN could bring digital and child-protection officials together to build comparable evidence on harms, children’s movement between services, and the privacy and access costs of different measures. Member states would then engage the major platforms on the basis of shared regional evidence, a stronger position than any one government’s compliance figures would provide.
Indonesia’s restrictions respond to real and urgent concerns, but it is too early to judge their effects. The early implementation evidence already shows that, while a government can compel platforms to act, the effectiveness of such action for child online safety depends on platform-side implementation, which takes place across borders. That dependence makes Indonesia’s experience a regional question as much as a national one. Existing ASEAN frameworks offer a basis on which to build compatible expectations, age-assurance principles and shared evidence. ASEAN’s measure of progress should be based on whether the systems children continue to encounter are actually becoming safer.
